github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2025-01-24 08:30:44 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #1635 from sharelatex/as-fix-broken-chat-mathjax

Browse source 
Fix broken messages in chat due to mathjax XSS filtering

GitOrigin-RevId: 8d5eb1f4df6496cafabff4669e5e59633c160647
This commit is contained in:
Alasdair Smith 2019-03-18 11:59:46 +00:00 committed by sharelatex
parent 41f75b5936
commit e6e3c023ed
2 changed files with 10 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
services/web/app/views/project/editor/chat.pug
View file

@ -41,6 +41,7 @@ aside.chat(
.message-content
p(
mathjax,
mathjax-allow-html="true",
ng-repeat="content in message.contents track by $index"
)
span(ng-bind-html="content | linky:'_blank':{rel: 'noreferrer noopener'}")

14
services/web/public/src/directives/mathjax.js
View file

@ -1,15 +1,19 @@
/* global MathJax, _ */
define(['base'], function(App) {
return App.directive('mathjax', function($compile) {
return App.directive('mathjax', function($compile, $parse) {
return {
link(scope, element, attrs) {
if (!(MathJax && MathJax.Hub)) return
const mathJaxContents = element.html()
const nonBindableEl = $compile('<span ng-non-bindable></span>')({})
element.html('').append(nonBindableEl)
nonBindableEl.html(mathJaxContents)
// Allowing HTML can be unsafe unless using something like
// `ng-bind-html` because of potential Angular XSS via {{/}}
if (!$parse(attrs.mathjaxAllowHtml)(scope)) {
const mathJaxContents = element.html()
const nonBindableEl = $compile('<span ng-non-bindable></span>')({})
element.html('').append(nonBindableEl)
nonBindableEl.html(mathJaxContents)
}
if (attrs.delimiter !== 'no-single-dollar') {
const inlineMathConfig =